Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat Asia
May 4-7, 2021
Virtual Event
Black Hat USA
July 31 - August 5, 2021
Las Vegas, NV, USA
Black Hat Europe
November 8-11, 2021
Virtual Event
2/22/2019
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Learn to Plug (or Exploit) New Vulnerabilities at Black Hat Asia

There's no better place to bone up on the ins and outs of web security than Black Hat Asia in Singapore next month.

The humble web browser is a workhorse of the modern world, and it can get you into some real trouble if you’re not careful.

Security experts know that better than most, and there’s no better place to bone up on the ins and outs of web security than Black Hat Asia in Singapore next month, where a bevy of Briefings, Trainings, and Arsenal tool demos offer loads of opportunities for hands-on learning.

Who Left Open the Cookie Jar?” is a 50-minute Briefing where researchers Tom Van Goethem and Gertjan Franke will walk you through how several flaws in seven browsers and 46 browser extensions purportedly block third-party cookies.

You want to see this Briefing to learn how the researchers novel techniques can prevent attackers from circumventing many of today’s built-in protection mechanisms. They’ll also show you that for every anti-tracking or ad-blocking browser extension there exists at least one technique to bypass its defenses, then offer a solution and analyze why these bypass techniques exist.

For a different perspective on Web security, check out the 25-minute Briefing on “Make Redirection Evil Again - URL Parser Issues in OAuth.” You’ll get a quick refresher on the security community's understanding of OAuth redirection threats, learn how OAuth has evolved and what the best practices are for implementing it in your own projects.

Now, the fun part: You’ll get a demonstration of new OAuth redirection attack techniques which exploit the interaction of URL parsing problems with redirection handling in mainstream browsers or mobile apps. In particular, some attacks leverage newly-discovered URL interpretation bugs in mainstream browsers or the Android platform. (The latter were independently discovered and have been recently patched.)

Don’t forget to stop by the Black Hat Asia Arsenal (located in the Business Hall) to enjoy some live demos of useful web security tools and chat with the folks who make them. Catch “A Look at ModSec 3.0 for NGINX: A Software Web Application Firewall” on Friday morning to see how at how the popular open-source proxy server NGINX can be combined with the respected open-source web app firewall ModSecurity to create an effective, secure layer for your web application stack.

You can also see the latest version of ModSecurity live during the “ModSecurity 3.1: Stepping up the Game for Web Attacks” Arsenal demo. The 3.1 release promises improved performance, stability and new exciting features including an exclusive testing feature that allows rules writers and WAF administrators to effortlessly search and match for known malware payloads and signatures. Be sure to stop by and check it out!

Get a firsthand look at a new web exploit by attending the “ReDTunnel: Explore Internal Networks via DNS Rebinding Tunnel” Arsenal demo. You’ll see how researchers have found a new way to attack web browsers by combining two concepts: JavaScript reconnaissance techniques and the DNS rebinding attack.

The result (at least if everything works well) is that you open your browser, wait until the victim visits your website, and then start browsing the internal websites in their network. It’s a great trick (especially if you’re part of a red team), and the best way to see it is to come to Black Hat Asia next month.

Black Hat Asia returns to the Marina Bay Sands in Singapore March 26-29, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-35519
PUBLISHED: 2021-05-06
An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel i...
CVE-2021-20204
PUBLISHED: 2021-05-06
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbi...
CVE-2021-30473
PUBLISHED: 2021-05-06
aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
CVE-2021-32030
PUBLISHED: 2021-05-06
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_chec...
CVE-2021-22209
PUBLISHED: 2021-05-06
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed.